The Wild Apricot Login plugin for WordPress versions up to 1.0.18 contains an authentication bypass vulnerability via SSO email-collision account binding. Attackers controlling a Wild Apricot contact with an email matching a WordPress administrator can authenticate as that administrator without proof of account ownership. This allows issuance of a valid network-wide authentication cookie on WordPress Multisite networks, granting administrator access across subsites.
SSL Wireless SMS Notification for WordPress versions up to and including 3.8.1 contains an authentication bypass vulnerability. The flaw allows unauthenticated attackers who know a phone-linked user's number to take over that account by exploiting improper verification in the login process. The vulnerability arises because the final login step matches user sessions based solely on attacker-controlled data without verifying the SMS OTP or server-side state.
The Schema App Structured Data plugin for WordPress up to version 2.3.2 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping in the 'Remove Microdata' output filter. An unauthenticated attacker can inject malicious scripts via comment content, which execute when users view the affected pages. Exploitation requires that an administrator has enabled the 'Remove Microdata' option and approved the malicious comment.
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish WordPress plugin versions up to 4.1.12 contains a SQL Injection vulnerability via the 'exclude_posts' parameter. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and query preparation. Additionally, the HMAC authentication protecting the endpoint can be bypassed on fresh installations before the administrator visits the settings page, as the secret key is not yet generated, enabling attackers to compute valid tokens. The vulnerability has a high severity score of 7.5 CVSS v3.1.
The SendPress Newsletters plugin for WordPress contains a time-based SQL Injection vulnerability in the 'subscriberid' parameter affecting all versions up to 1.26.1.20. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient input escaping and ineffective nonce protection. The nonce uses a hardcoded action value that is publicly accessible, enabling attackers to bypass access controls and potentially extract sensitive database information.
The Food Store – Online Food Delivery & Pickup WordPress plugin up to version 1.5.5 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'service_type' cookie. An unauthenticated attacker can inject malicious scripts by supplying a crafted payload through the public checkout page's ?type= query parameter. This payload is stored in the cookie, persisted in order metadata, and rendered without proper escaping in the admin panel, leading to script execution when accessed.
The DSGVO All in one for WP WordPress plugin up to version 5.0 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping in comment content when certain plugin options are enabled. Specifically, exploitation requires the administrator to have enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and the malicious comment must be approved by an administrator. Successful exploitation allows unauthenticated attackers to inject arbitrary scripts that execute in users' browsers when they visit the affected pages.
The Bot for Telegram on WooCommerce WordPress plugin versions up to and including 1.3.0 contains an authentication bypass vulnerability. An unauthenticated attacker can exploit a REST endpoint that lacks proper permission checks and signature verification to forge bot updates. This allows the attacker to impersonate any WordPress user by username and obtain a login token. The token can then be used to create an authenticated session cookie without any capability checks or nonces, enabling full account takeover, including administrator accounts.
openEQUELLA versions prior to 2026.2 have a stored cross-site scripting (XSS) vulnerability in the pre-login notice feature. The notice is stored as HTML and rendered on the legacy login page without proper encoding or sanitization. Users with the EDIT_SYSTEM_SETTINGS permission can inject arbitrary scripts via the pre-login notice API endpoint. If this permission is granted to guest or Everyone users, unauthenticated exploitation is possible.
openEQUELLA versions before 2026.1 contain a vulnerability in the pre-login notice image upload endpoint that allows users with EDIT_SYSTEM_SETTINGS permission to upload HTML files without proper type validation. These files are served with a Content-Type based on the filename, enabling stored cross-site scripting (XSS). If the permission is granted to unauthenticated users, exploitation can occur without authentication.
openEQUELLA versions before 2026.1 have a vulnerability in the GET /api/userquery/userinfobackup endpoint, which does not perform authentication or authorization checks. This allows an unauthenticated attacker to retrieve personal details such as username, first name, last name, and email address of any user within the same institution by supplying their uniqueId.
openEQUELLA versions before 2026.1 have a vulnerability in the SOAP API's stopEdit operation where XML parsing resolves external entities. This flaw enables attackers to read arbitrary files accessible by the service or perform server-side request forgery (SSRF). The vulnerability has a medium severity rating with a CVSS score of 6.1.
In openEQUELLA versions before 2026.1, the system.execute() function in the scripting engine allows execution of arbitrary operating system commands without validation or an allow-list. This enables users with script creation or editing privileges to run commands with the openEQUELLA service account's privileges, leading to a critical security risk.
openEQUELLA versions before 2026.1 contain a vulnerability in the XML parser used for item metadata. The parser does not disable external entity resolution, allowing a user with CREATE_ITEM permission to submit crafted XML to the POST /api/item endpoint. This can lead to the server reading arbitrary files accessible to the service or making server-side requests to attacker-specified locations, including cloud instance metadata services.
The Ortto plugin for WordPress versions before 1.0.25 improperly handled WooCommerce product data embedded in public storefront pages, allowing unauthenticated attackers to access product passwords and private metadata. This vulnerability could expose sensitive product information without requiring authentication.
The Ortto plugin for WordPress versions before 1.0.25 does not properly authenticate configuration update requests. It relies solely on a secret exposed in public HTML, allowing unauthenticated attackers to overwrite the plugin's configuration and serve arbitrary scripts.
The Ortto plugin for WordPress versions before 1.0.25 contains a stored cross-site scripting (XSS) vulnerability due to improper escaping of stored settings on its admin settings page. This flaw allows a threat actor with the ability to modify the plugin's configuration to execute arbitrary JavaScript in an administrator's session when the affected page is visited.
An improper input validation vulnerability in Bixby versions prior to 4.0.85.6 allows privileged local attackers to launch arbitrary activities. This flaw affects local users with elevated privileges and can lead to unauthorized activity execution. The vulnerability has a high severity rating with a CVSS score of 8.3. No known exploits in the wild have been reported. The issue is fixed starting from version 4.0.85.6.
A security vulnerability in the nipy nibabel library up to version 5.4.2 affects the function array_from_file in nibabel/volumeutils.py. This flaw leads to uncontrolled memory allocation and can be exploited remotely. A fix has been proposed via a pull request but has not yet been accepted or released.